diff --git a/tools/ci/config/build.yml b/tools/ci/config/build.yml
index bd4bbcdd6e..542b2fc33d 100644
--- a/tools/ci/config/build.yml
+++ b/tools/ci/config/build.yml
@@ -440,7 +440,7 @@ build_template_app:
     # get all exclude paths specified in tools/ci/sonar_exclude_list.txt | ignore lines start with # | xargs | replace all <space> to <comma>
     - export CUSTOM_EXCLUDES=$(cat $CI_PROJECT_DIR/tools/ci/sonar_exclude_list.txt | grep -v '^#' | xargs | sed -e 's/ /,/g')
     # Exclude the report dir
-    - export EXCLUSIONS="$SUBMODULES,$REPORT_DIR/**,docs/_static/**,**/*.png,**/*.jpg"
+    - export EXCLUSIONS="$CUSTOM_EXCLUDES,$SUBMODULES,$REPORT_DIR/**,docs/_static/**,**/*.png,**/*.jpg"
     - python $NORMALIZE_CLANGTIDY_PY $CI_PROJECT_DIR/$REPORT_DIR/warnings.txt $CI_PROJECT_DIR/$REPORT_DIR/clang_tidy_report.txt $CI_PROJECT_DIR
   variables:
     GIT_DEPTH: 0
diff --git a/tools/ci/sonar_exclude_list.txt b/tools/ci/sonar_exclude_list.txt
index c3ac06f251..a91e445f52 100644
--- a/tools/ci/sonar_exclude_list.txt
+++ b/tools/ci/sonar_exclude_list.txt
@@ -9,3 +9,7 @@
 # FreeRTOS upstream code (don't include our port files here)
 components/freertos/*.c
 components/freertos/include/freertos/*.h
+
+# wpa_supplicant upstream code
+components/wpa_supplicant/src/**
+components/wpa_supplicant/include/**